Weld Pond
1696837
222064870
2008-06-27T11:45:15Z
RussBot
279219
Robot-assisted [[WP:D|disambiguation]]: Hacker
[[Image:Chriswysopal-sm.jpg|right|131px|Chris Wysopal, 2007]]
'''Chris Wysopal''' (also known as '''Weld Pond''') was a member of the high profile [[Hacker (computer security)|hacker]] [[think tank]], the [[L0pht]].
Weld Pond earned a [[bachelor's degree]] in Computer Systems & Engineering from [[Rensselaer Polytechnic Institute]].
Weld Pond was the seventh member to join the L0pht. His projects there included [[L0phtCrack]] and [[Netcat]] for Windows. He was also [[webmaster]]/graphic designer for the L0pht's web site, and for [[Hacker News Network]] (the first hacker [[blog]]). He researched and published security advisories on vulnerabilities in [[Microsoft Windows]], [[Lotus Notes|Lotus Domino]], [[IIS|Microsoft IIS]], and [[ColdFusion]]. Weld was one of the seven L0pht members who testified before a [[United States Senate|Senate]] committee in [[1998]] that they could bring down the [[Internet]] in 30 minutes. When L0pht was acquired by [[@stake]] in [[1999]], he became the manager of @stake's Research Group and later became @stake's [[Vice President]] of [[Research and Development]]. In [[2004]], when @stake was acquired by [[Symantec]], he became its Director of Development.
Weld was instrumental in developing industry guidelines for disclosing a [[software security vulnerability]] responsibly. He was a contributor to the first vulnerability disclosure policy, [[RFPolicy]]. In 2002, along with [[Steve Christey]] of [[MITRE]], he proposed an [[IETF]] [[RFC]] titled "Responsible Vulnerability Disclosure Process". The process was eventually rejected by the IETF as not within their purview. However, the process did become the foundation for [http://www.oisafety.com/ Organization for Internet Safety], an industry group bringing together software [[vendor|vendors]] and security [[researcher|researchers]], of which Weld Pond was a founder. In [[2003]] he testified before a [[United States House of Representatives]] subcommittee on the topic of vulnerability research and disclosure.
In 2001, he founded the non-profit, [[full disclosure]] [[mailing list]], [http://www.vulnwatch.org VulnWatch], for which he is a [[forum moderator|moderator]].
He is presently the co-founder and CTO of [http://www.veracode.com Veracode], a spin-off from Symantec.
In April 2008 he married Debra Kavaler, who works in New York real estate.
In 2008, Chris was recognized for his achievements in the IT industry by being named one of the [http://www.eweek.com/c/a/IT-Management/100-Most-Influential-People-in-IT/4/ 100 Most Influential People in IT] by [[eWeek]] and selected as one of the [http://www.infoworld.com/article/08/06/02/23FE-cto25-wysopal_1.html InfoWorld CTO 25].
== Bibliography ==
'''Books'''
*{{cite book
|author = Wysopal, Chris
|coauthors = Lucas Nelson, Dino Dai Zovi, Elfriede Dustin
|date = [[November 1]] [[2006]]
|title = '''The Art of Software Security Testing'''
|edition = (First Edition)
|publisher = Addison-Wesley
|id = ISBN 0-321-304865-1
}}
'''Articles'''
* {{cite news
| url=http://news.zdnet.com/2100-9595_22-523048.html
| title=Do Security Holes Demand Full Disclosure
| last=Wysopal
| first=Chris
| date=August 16, 2000
| publisher=ZDNet News
}}
* {{cite news
| url=http://news.zdnet.com/2100-9595_22-524352.html
| title=Why the world needs reverse engineers
| last=Wysopal
| first=Chris
| date=October 9, 2000
| publisher=ZDNet News
}}
* {{cite news
| url=http://www.usenix.org/publications/login/2003-12/pdfs/wysopal.pdf
| title=Learning Security QA from Vulnerability Researchers
| last=Wysopal
| first=Chris
| date=December 2003
| publisher=USENIX ;login:
}}
* {{cite news
| url=http://www.stickyminds.com/s.asp?F=S8260_MAGAZINE_2
| title=Case Your Own Joint
| last=Wysopal
| first=Chris
| date=October 2004
| publisher=Better Software Magazine
}}
* {{cite news
| url=http://www.usenix.org/publications/login/2004-12/pdfs/code.pdf
| title=Putting Trust in Software Code
| last=Wysopal
| first=Chris
| date=December 2004
| publisher=USENIX ;login:
}}
* {{cite news
| url=http://www.gcn.com/print/25_21/41397-1.html
| title=Government IT security begins at app level
| last=Wysopal
| first=Chris
| date=July 24, 2006
| publisher=Government Computer News
}}
* {{cite news
| url=http://www.scmagazineus.com/Building-security-into-your-software-development-lifecycle/article/104705/
| title=Building security into your software-development lifecycle
| last=Wysopal
| first=Chris
| date=January 30, 2008
| publisher=SC Magazine
}}
== External links ==
*[http://hsgac.senate.gov/l0pht.htm U.S. Senate Press Release: HEARINGS ANNOUNCED ON COMPUTER SECURITY FAILURES IN GOVERNMENT]
*[http://tools.ietf.org/draft/draft-christey-wysopal-vuln-disclosure/draft-christey-wysopal-vuln-disclosure-00.txt Responsible Vulnerability Disclosure Process]
*[http://www.iwar.org.uk/comsec/resources/worm-virus-defense/wysopal-09-10-03.pdf Hearing on “Worm and Virus Defense: How Can We Protect the Nation’s Computers from These Threats?”]
*[http://www.vulnwatch.org VulnWatch vulnerability disclosure list]
[[Category:L0pht]]
[[Category:Computer security specialists|Pond, Weld]]
[[Category:Rensselaer Polytechnic Institute alumni|Pond, Weld]]